dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add permissions for every table (view, add, edit, and delete). Important change to increase security on the REST API and will be beneficial for more detailed control of permissions.

Browse Source
This commit is contained in:
Mark Crane
2013-09-25 20:23:10 +00:00
parent 99f6238790
commit 7ba40f465e
27 changed files with 816 additions and 331 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/vars/app_config.php
+11 -11
View File
@@ -36,17 +36,17 @@
$apps[$x]['menu'][0]['groups'][] = 'superadmin';
//permission details
$apps[$x]['permissions'][0]['name'] = 'variable_view';
$apps[$x]['permissions'][0]['groups'][] = 'superadmin';
$apps[$x]['permissions'][1]['name'] = 'variable_add';
$apps[$x]['permissions'][1]['groups'][] = 'superadmin';
$apps[$x]['permissions'][2]['name'] = 'variable_edit';
$apps[$x]['permissions'][2]['groups'][] = 'superadmin';
$apps[$x]['permissions'][3]['name'] = 'variable_delete';
$apps[$x]['permissions'][3]['groups'][] = 'superadmin';
$apps[$x]['permissions'][$y]['name'] = 'var_view';
$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
$y++;
$apps[$x]['permissions'][$y]['name'] = 'var_add';
$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
$y++;
$apps[$x]['permissions'][$y]['name'] = 'var_edit';
$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
$y++;
$apps[$x]['permissions'][$y]['name'] = 'var_delete';
$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
//schema details
$apps[$x]['db'][$y]['table'] = 'v_vars';
app/vars/var_delete.php
+7 -6
View File
@@ -17,7 +17,7 @@
The Initial Developer of the Original Code is
Mark J Crane <markjcrane@fusionpbx.com>
Portions created by the Initial Developer are Copyright (C) 2008-2012
Portions created by the Initial Developer are Copyright (C) 2008-2013
the Initial Developer. All Rights Reserved.
Contributor(s):
@@ -26,7 +26,7 @@
include "root.php";
require_once "resources/require.php";
require_once "resources/check_auth.php";
if (permission_exists('variable_delete')) {
if (permission_exists('var_delete')) {
//access granted
}
else {
@@ -40,12 +40,13 @@ else {
$text[$key] = $value[$_SESSION['domain']['language']['code']];
}
if (count($_GET)>0) {
$id = $_GET["id"];
}
//get the id
if (count($_GET) > 0) {
$id = $_GET["id"];
}
//delete the data
if (strlen($id)>0) {
if (strlen($id) > 0) {
$sql = "delete from v_vars ";
$sql .= "where var_uuid = '$id' ";
$prep_statement = $db->prepare(check_sql($sql));
app/vars/vars.php
+6 -6
View File
@@ -26,7 +26,7 @@
include "root.php";
require_once "resources/require.php";
require_once "resources/check_auth.php";
if (permission_exists('variable_view')) {
if (permission_exists('var_view')) {
//access granted
}
else {
@@ -90,7 +90,7 @@ else {
$tmp_var_header .= th_order_by('var_enabled', $text['label-enabled'], $order_by, $order);
$tmp_var_header .= "<th>".$text['label-description']."</th>\n";
$tmp_var_header .= "<td align='right' width='42'>\n";
if (permission_exists('variable_add')) {
if (permission_exists('var_add')) {
$tmp_var_header .= " <a href='var_edit.php' alt='".$text['button-add']."'>$v_link_label_add</a>\n";
}
$tmp_var_header .= "</td>\n";
@@ -111,7 +111,7 @@ else {
echo " <td width='33.3%' nowrap>&nbsp;</td>\n";
echo " <td width='33.3%' align='center' nowrap>&nbsp;</td>\n";
echo " <td width='33.3%' align='right'>\n";
if (permission_exists('variable_add')) {
if (permission_exists('var_add')) {
echo " <a href='var_edit.php' alt='".$text['button-add']."'>$v_link_label_add</a>\n";
}
echo " </td>\n";
@@ -142,10 +142,10 @@ else {
$var_description = str_replace(" ", "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;", $var_description);
echo " <td valign='top' align='left' class='".$row_style[$c]."'>".$var_description."&nbsp;</td>\n";
echo " <td valign='top' align='right'>\n";
if (permission_exists('variable_edit')) {
if (permission_exists('var_edit')) {
echo " <a href='var_edit.php?id=".$row['var_uuid']."' alt='".$text['button-edit']."'>$v_link_label_edit</a>\n";
}
if (permission_exists('variable_delete')) {
if (permission_exists('var_delete')) {
echo " <a href='var_delete.php?id=".$row['var_uuid']."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>\n";
}
echo " </td>\n";
@@ -164,7 +164,7 @@ else {
echo " <td width='33.3%' nowrap>&nbsp;</td>\n";
echo " <td width='33.3%' align='center' nowrap>$paging_controls</td>\n";
echo " <td width='33.3%' align='right'>\n";
if (permission_exists('variable_add')) {
if (permission_exists('var_add')) {
echo " <a href='var_edit.php' alt='".$text['button-add']."'>$v_link_label_add</a>\n";
}
echo " </td>\n";
app/vars/vars_textarea.php
+5 -5
View File
@@ -26,7 +26,7 @@
include "root.php";
require_once "resources/require.php";
require_once "resources/check_auth.php";
if (permission_exists('variable_view')) {
if (permission_exists('var_view')) {
//access granted
}
else {
@@ -45,7 +45,7 @@ else {
$page["title"] = $text['title-variables_advanced'];
//restore the default vars.xml
if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
if ($_GET['a'] == "default" && permission_exists('var_edit')) {
//read default config file
$fd = fopen($_SESSION['switch']['conf']['dir'].".orig/vars.xml", "r");
$v_content = fread($fd, filesize($_SESSION['switch']['conf']['dir'].".orig/vars.xml"));
@@ -59,7 +59,7 @@ if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
}
//save the vars.xml
if ($_POST['a'] == "save" && permission_exists('variable_edit')) {
if ($_POST['a'] == "save" && permission_exists('var_edit')) {
$v_content = str_replace("\r","",$_POST['code']);
$fd = fopen($_SESSION['switch']['conf']['dir']."/vars.xml", "w");
fwrite($fd, $v_content);
@@ -107,7 +107,7 @@ if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
<br /><br />
</td>
<td align='right' valign='top'>
<?php if (permission_exists('variable_edit')) { ?>
<?php if (permission_exists('var_edit')) { ?>
<input type="submit" class='btn' value="<?=$text['button-save']?>" />
<?php } ?>
</td>
@@ -133,7 +133,7 @@ if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
<input type="hidden" name="f" value="<?php echo $_GET['f']; ?>" />
<input type="hidden" name="a" value="save" />
<?php
if (permission_exists('variable_edit')) {
if (permission_exists('var_edit')) {
echo "<input type='button' class='btn' value='".$text['button-restore']."' onclick=\"document.location.href='vars.php?a=default&f=vars.xml';\" />";
}
?>